WO2006103646A2

WO2006103646A2 - Home networking security solution

Info

Publication number: WO2006103646A2
Application number: PCT/IL2006/000002
Authority: WO
Inventors: Leonid Sandler; Yaron Sella
Original assignee: NDS Ltd
Current assignee: Synamedia Ltd
Priority date: 2005-03-30
Filing date: 2006-01-01
Publication date: 2006-10-05
Anticipated expiration: 2007-09-30
Also published as: WO2006103646A3

Abstract

A method of authenticating a device in a network (Fig. 3), the method comprising providing a network (100), the network (100) comprising an authentication granting device, a first device (120); and a second device (130), the authentication granting device granting a first certificate (220) to the first device (120) at least one of when the first device (120) loins the network (100), and at a later time, the first certificate (220) comprising a physical address corresponding to a physical address of the first device (120),the first certificate (220) representing proof that the first device (120) is comprised in the network (100), the authentication granting device granting a second certificate (230) to the second device (130) at least one of when the second device (130) joins the network (100) and at a later time, the second certificate (230) comprising a physical address corresponding to a physical address of the second device (130), the second certificate (230) representing proof that the second device (130) is comprised in the network (100), the first device (120) ( 120) requesting authentication from the second device (130), the authentication comprising at least a certification that the second device (130) is comprised in the network (100); and the second device (130) providing the certification to the first device, the certification comprising at least a portion of the second certificate (230).

Description

HOME NETWORKING SECURITY SOLUTION

RELATED APPLICATION IFORMATION The present application claims the benefit of priority from US Provisional Application 60/666,418, filed on 30 March 2005.

FIELD OF THE INVENTION

The present invention relates to home networking technology, and more specifically, to ways of ensuring that a device is legitimately a member of a home network.

BACKGROUND OF THE INVENTION

A Media Access Control address (MAC address) is a unique identifier attached to most forms of networking equipment. MAC addresses are permanently attached to a device, and are often referred to as "burned-in addresses". Although technically MAC addresses are used specifically in network hardware and EUI-48 (48 bit Extended Unique Identifier) addresses are used to identify other hardware and devices, the two types of address are syntactically indistinguishable. MAC addresses are often referred to as "physical addresses". X.509 is a well known standard for public key infrastructure. X.509 specifies, among other things, standard formats for public key certificates and a certification path validation algorithm. X.509 v3 certificate and X.509 v2 Certificate Revocation List (CRL) for use in the Internet are specified in RFC 3280. Paragraph 4.2 of IETF RFC 3280 specifies extensions to X.509 v3 certificates. European Patent EP 1326365 to Samsung Electronics Co., Ltd. describes a communication gateway and method that is able to execute a function of a security protocol for home devices that lack the ability to process a security protocol. The communication connecting apparatus, as described in EP 1326365, comprises a protocol detector for detecting a key exchange protocol in a packet received from an external device, a list storage unit for storing a list of devices for executing a certification procedure, and an agent unit for executing a certification procedure by transmitting a certification signal to the external device when a device corresponding to the key exchange unit exists in a device list. By this method, security can be assured not only outside but also inside of the home network in transceiving data between a device connected to the home network and the remote client.

European Patent Application EP 1519258 of Electronics Co., Ltd. describes a method of establishing a home domain capable of reproducing multimedia content, and a smart card therefor. The method includes creating a domain certificate for a reproducing device by inserting the smart card into the reproducing device, creating a session key by inserting the smart card into a home server, and verifying the domain certificate of the reproducing device and transmitting the created session key to the reproducing device if the device is a legitimate device. Alternatively, the method includes using an external certificate authority to determine whether the reproducing device is a legitimate device. The smart card includes a certificate- creating module for creating a domain certificate for a reproducing device when the smart card is inserted into the reproducing device, a session key-creating module for creating a session key when the smart card is inserted into the home server, and a certificate- verifying module for verifying the domain certificate of the reproducing device before transmission of the created session key to the reproducing device.

PCT Patent Application WO 01/22661 of Thomson Multimedia describes a method for registering a device in a wireless network comprising a central access point. The method comprises the steps of: sending an identification code from the device to the access point; checking by said access point whether the received identification code corresponds to the identification code sent by said device and if such checking is positive, sending an authentication key from said access point to said device; storage of said authentication key by said device for use in authentication procedures between said device and said access point.

Published US Patent Application 2004/0244032 of Yamada describes a receiving apparatus comprising a receiving unit which receives a contents signal from a broadcast station in accordance with the result of authentication processing executed with the broadcast station, a registration unit which executes communication with an external communication device, and sets and registers an ID in a range of a predetermined number, and a communication unit which executes authentication processing with an external device using the ID and transmits the contents of the contents signal to the external device in accordance with the result of the authentication. A communication apparatus connected to the receiving apparatus through a network in a home is managed using a family ID thereby to protect the copyright of the contents of a fee-charging broadcast service or the like. Published US Patent Application 2004/0205335 of Park describes a home device authentication system and method, wherein the home device authentication system includes one or more home devices each having device information including coding information for authentication and information on a service provider providing authentication services; and a home gateway including decoding information corresponding to the coding information of the home devices, and for authenticating the home devices by using the decoding information.

US Patent 6,856,800 to Henry, et al., describes a fast authentication and access control method of authenticating a network access device to a communications network having an access point communicating with a remote authentication server for the network access device. The method includes the step of receiving an access request having an authentication credential from the network access device at the access point. The authentication credential includes a security certificate having a public key for the network access device and an expiration time. The security certificate is signed with a private key for the remote authentication server. The access point locally validates the authentication credential by accessing the public key of the remote authentication server from a local database, and checking the signature and expiration time of the security certificate. If the authentication credential is validated at the access point, the access point grants the network access device conditional access to the network by sending an access granted message to the network access device. The access granted message includes a session key encrypted with a public key for the network access device. The session key is stored in a database associated with the access point. The access point contacts the remote authentication server to check a revocation status of the security certificate for the network access device. If the access point receives a message from the remote authentication server that the authentication credential for the network access device has been revoked, it suspends network access for the network access device. The disclosures of all references mentioned above and throughout the present specification, as well as the disclosures of all references mentioned in those references, are hereby incorporated herein by reference.

SUMMARY OF THE INVENTION

The present invention, in preferred embodiments thereof, seeks to provide an improved method and system for ensuring that a device is certified by a network operator as being part of a home network.

There is thus provided in accordance with a preferred embodiment of the present invention providing a network, the network comprising an authentication granting unit, a first device, and a second device, the authentication granting unit granting a first certificate to the first device at at least one of when the first device joins the network, and at a later time, the first certificate including a physical address corresponding to a physical address of the first device, the first certificate representing proof that the first device is included in the network, the authentication granting unit granting a second certificate to the second device at at least one of when the second device joins the network, and at a later time, the second certificate including a physical address corresponding to a physical address of the second device, the second certificate representing proof that the second device is included in the network, the first device requesting authentication from the second device, the authentication including at least a certification that the second device is included in the network, and the second device providing the certification to the first device, the certification including at least a portion of the second certificate.

Further in accordance with a preferred embodiment of the present invention the first certificate and the second certificate each further includes a network ID.

Still further in accordance with a preferred embodiment of the present invention the network ID is unique to the network.

Additionally in accordance with a preferred embodiment of the present invention the first certificate and the second certificate each includes an X.509 certificate. Moreover in accordance with a preferred embodiment of the present invention the network is a home network.

Further in accordance with a preferred embodiment of the present invention the first device also includes an authentication granting unit. Still further in accordance with a preferred embodiment of the present invention content is transferred between the first device and the second device only after the second device has provided the first device with the certification that the second device is included in the network.

Additionally in accordance with a preferred embodiment of the present invention the first device is additionally connected to a second network.

Moreover in accordance with a preferred embodiment of the present invention the second device is additionally connected to a second network.

Further in accordance with a preferred embodiment of the present invention the second network includes the Internet. Still further in accordance with a preferred embodiment of the present invention at least on of the first certificate and the second certificate are cached at a network switch / hub.

Additionally in accordance with a preferred embodiment of the present invention the content includes a digital rights management (DRM) descriptor. Moreover in accordance with a preferred embodiment of the present invention the DRM descriptor includes one of the following restrictions / limitations no transfer at all, even within the home network, free transfer within the home network , and no transfer outside of the home network, and free transfer both inside and outside the home network. Further in accordance with a preferred embodiment of the present invention and wherein the content is only transferred between the first device and the second device if in accordance with the DRM descriptor.

There is also provided in accordance with a another preferred embodiment of the present invention in a network including an authentication granting unit, a first device, and a second device, the authentication granting device operative to grant a first certificate to the first device at at least one of when the first device joins the network, and at a later time, the first certificate including a physical address corresponding to a physical address of the first device, the first certificate representing proof that the first device is included in the network, the authentication granting device operative to grant a second certificate to the second device at at least one of when the second device joins the network, and at a later time, the second certificate including a physical address corresponding to a physical address of the second device, the second certificate representing proof that the second device is included in the network, the first device operative to request authentication from the second device, the authentication including at least a certification that the second device is included in the network, and the second device operative to provide the certification to the first device, the certification including at least a portion of the second certificate.

BRIEF DESCRIPTION OF THE DRAWINGS AND APPENDIX

The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which: Fig. 1 is a simplified block diagram illustration of an exemplary home entertainment network constructed and operative in accordance with a preferred embodiment of the present invention;

Fig. 2 is a simplified partly pictorial, partly block diagram illustration of the home entertainment network of Fig. 1, after an unauthorized device has been added;

Fig. 3 is a simplified partly pictorial, partly block diagram illustration of the home entertainment network of Fig. 1 , depicting an exemplary network operation;

Fig. 4 is a simplified partly pictorial, partly block diagram illustration of the home entertainment network of Fig. 1 , depicting an exemplary invalid network operation; and

Fig. 5 is a simplified flow chart of a preferred method of operation of the present invention according to the preferred embodiment described with reference to Figs. 2 - 4. The following Appendix may be helpful in understanding certain preferred embodiments of the present invention:

Appendix A is a basic syntax for X.509 v3 certificates, as per RFC 3280.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

Reference is now made to Fig. I₅ which is a simplified block diagram illustration of an exemplary home entertainment network 100 constructed and operative in accordance with a preferred embodiment of the present invention. Those ^■ skilled in the art will appreciate that the network, as depicted in Fig. 1 , is depicted in a typical so-called star architecture. The system and method of the present invention does not depend on network architecture, and thus, any appropriate network architecture may be used in conjunction with the present invention. The exemplary home network depicted in Fig. 1 comprises various devices which are used for home entertainment. Specifically, the network in Fig. 1 comprises a set top box 110, a personal video recorder (PVR) 120, a digital versatile disk (DVD) device 130, ahome computer 140, a portable device 150, a video player 160, and digital music system 170. The home network 100 may comprise any or all of these devices, may comprise other appropriate devices, and may comprise multiple devices of the same kind. For example, and without limiting the generality of the foregoing, the home network may comprise a set top box, two PVRs, two computers and four digital music systems. Typically the home network further comprises a home network switch / hub 180.

Digital content may be passed around freely between appropriate devices. For example, and without limiting the generality of the foregoing, a movie viewed on the set top box 110 may be transferred to storage on the PVR 120, thereby ensuring that a digital quality copy of the movie is stored. A broadcaster or owner of the content may, however, want to ensure that revenue for viewing the movie continues, and thus the broadcaster or owner of the content may wish to control rights over the content. For example, the content owner may wish to allow copying the content to any device in a subscriber' s home network 100, but not to a device outside of the subscriber's home network.

Each authorized device on the network receives a digital certificate from a certificate authority. The certificate certifies the device as a member of a particular home network. Thus, a device which comprises a certificate identifying the device as part of a particular network may transfer content to a second device also comprising a certificate identifying the device as part of the same particular network. Reference is now additionally made to Appendix A, which is a basic syntax for X.509 v3 certificates, as per RFC 3280. The certificate identifying the device as part of the particular network would either be an X.509 compliant certificate, or a proprietary certificate which comprises the same relevant information as an X.509 compliant certificate.

X.509 v3 allows for extensions to certificates (refer to paragraph 4.2 of RFC 3280). The extensions defined for X.509 v3 certificates provide methods for associating additional attributes with users or public keys and for managing a certification hierarchy. The X.509 v3 certificate format also allows communities to define private extensions to carry information unique to those communities. The present invention, in preferred embodiment thereof, requires that at least two extensions be added to the X.509 v3 certificate. Any certificate lacking the two extensions would be invalid, and thus, a device comprising a certificate lacking the two extensions would not be accepted as a valid member of the home network. A first extension comprises a home network identifier, which is an identifier for each network administered by the broadcaster or content owner. The home network identifier distinguishes between different home networks. Thus, for example, the Smith family home network with its home network identifier is distinguished from the Jones family network with its different home network identifier.

The home network identifier may preferably be either unique, where one identifier uniquely identifies a specific network_s or not unique. If the network is not unique, the identifier can preferably be used as at least part of a method to identify a second device with which a first device may preferably perform certain network actions, as described below. For example, and without limiting the generality of the foregoing, if the network identifier of two devices comprise the same three most significant bits, then the first and second devices may perform certain network actions as described below.

A second extension comprises a device physical address. Those skilled in the art will appreciate that in order to function as a member of a network, where layer two networking protocols are effected, a device must have a protocol compliant address. Level two addresses are frequently referred to as Media Access Control (MAC) addresses. MAC addresses are typically unique addresses which are burned into hardware comprised in a device. Thus, for example, a network enabled music system 170 will typically comprise a unique MAC address. Since MAC addresses are generally associated with hardware comprised in the device, and cannot be changed without physically changing the hardware, MAC addresses are also referred to as physical addresses. Those skilled in the art will appreciate that any other appropriate physical address may comprise the second extension.

It is appreciated that references to X.509 v3 certificates are by way of example only. In alternative preferred embodiments of the present invention, a proprietary certificate format may be used instead of the X.509 v3 certificate format.

The first time the device is physically attached to a home network, the device will preferably be required to provide its physical address to home networking software. The home networking software preferably only allows certain networking operations if communicating devices are part of the same home network. Proof that the communicating devices are part of the same home network is preferably adduced by the presence of the certificate described above. Typical operations subject to limitation by the home networking software include, but are not limited to content transfer or entitlement transfer. Those skilled in the art will appreciate that the transfer of the content or the transfer of the entitlement may preferably be performed either as a push transfer or as a pull transfer. Each content provider or broadcaster preferably provides an appropriate list of restricted actions to home networking software of its subscriber base.

Because an owner of a home network might have more than one home network 100, a networked device preferably may comprise more than one certificate. For example, and without limiting the generality of the foregoing, the network owner may opt to bring the PVR from his home to his vacation home. If the PVR has an appropriate certificate for both a network comprised in the home and a second network comprised in the vacation home, then network operations are allowed between the PVR 120 and other networked devices on both the home network and the vacation home network.

Reference is now made to Fig.2, which is a simplified partly pictorial, partly block diagram illustration of the home entertainment network 100 of Fig. 1, after an unauthorized device 200 has been added. In Fig.2, each authorized device on the network comprises a valid certificate 210, 220, 230, 240, 250, 260, 270, depicted as an illustration of a certificate. After the unauthorized device 200 has been added to the network 100, certain network operations between the unauthorized device and authorized devices on the network, as explained above, are prohibited. The prohibition of the certain network operations is depicted in Fig.2 with a "No" symbol - Q. For example, and without limiting the generality of the foregoing, transfer of content from the DVD 130 to the unauthorized device 200 would be prohibited.

In some preferred embodiments of the present invention, the home network switch / hub 180 preferably caches device certificates 210, 220, 230, 240, 250, 260, 270, rather than passing the certificates to the devices 120, 130, 140, 150, 160, 170 (Fig. 1).

Reference is now made to Fig.3, which is a simplified partly pictorial, partly block diagram illustration of the home entertainment network 100 of Fig. 1, depicting an exemplary valid network operation 300. The exemplary valid network operation depicts a transfer of content or an entitlement from the PVR 120 to the DVD 130. Because the transfer occurs between devices both comprising the valid certificate 220, 230, the transfer of the content or entitlement is permitted.

Reference is now made to Fig.4, which is a simplified partly pictorial, partly block diagram illustration of the home entertainment network 100 of Fig. 1, depicting an exemplary invalid network operation 400. The exemplary invalid network operation 400 depicts a transfer of content or an entitlement from the PVR 120 to the unauthorized device 200. Because the transfer occurs between a device comprising the valid certificate 220 and a device 200 not comprising the valid certificate, the transfer of the content or entitlement is not permitted. The prohibition of the transfer is depicted in Fig. 4 with the "No" symbol - 0.

Prohibiting the transfer between the device comprising the valid certificate 220 and the device 200 not comprising the valid certificate may preferably be enforced by at least one of the following: the device comprising the valid certificate 220; and the home network switch / hub 180. Alternatively, a combination of the device comprising the valid certificate 220 and the home network switch / hub 180 may prevent the transfer between the device comprising the valid certificate 220 and the device 200 not comprising the valid certificate. For the home network 100 to be regulated by the broadcaster or content owner, the broadcaster or content owner preferably maintains two databases. A first database preferably comprises information about the home networks, including the home network identifier mentioned above. A second database comprises device type, serial number, and physical address. Therefore, the network owner who wishes to add a device to his home network would preferably provide the broadcaster or content owner the device type and serial number. The network owner would issue the certificate with the first and second additional fields described above, comprising the home network identifier and the device physical address. Methods known in the art for delivering digital certificates to devices are preferably employed to deliver the certificate to the device.

In some preferred embodiments of the present invention, content may preferably comprise a copy security policy. For example and without limiting the generality of the foregoing, content may comprise a digital rights management (DRM) descriptor, as is well known in the art. The DRM descriptor preferably specifies any restrictions and / or limitations for the content, with respect to the home network 100. For example and without limiting the generality of the foregoing, the DRM descriptor may comprise one of the following restrictions / limitations: no transfer at all, even within the home network 100; free transfer within the home network 100, and no transfer outside of the home network 100; and free transfer both inside and outside the home network 100. In such an embodiment, the home networking software preferably is additionally operative to enforce the copy security policy as defined in the DRM descriptor.

Reference is now made to Fig. 5, which is a simplified flow chart of a preferred method of operation of the present invention according to the preferred embodiment described with reference to Figs.2 - 4. The method of Fig. 5 is believed to be self explanatory with reference to the above discussion. It is appreciated that various features of the invention which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable subcombination.

It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the invention is defined only by the claims which follow:

APPENDIX A

The X.509 v3 certificate basic syntax is as follows. For signature calculation, the data that is to be signed is encoded using the ASN.1 distinguished encoding rules (DER) [X.690] . ASN.1 DER encoding is a tag, length, value encoding system for each element.

Certificate ::= SEQUENCE { tbsCertificate TB S Certificate, signatureAlgorithm Algorithmldentifier, signatureValue BIT STRING }

TBSCertificate ::= SEQUENCE { version [0] EXPLICIT Version DEFAULT vl, serialNumber Certificates erialNumber, signature Algorithmldentifier, issuer Name, validity Validity, subject Name, subj ectPublicKeylnfo Subj ectPublicKeylnfo, issuerUniquelD [1] IMPLICIT Uniqueldentifier OPTIONAL,

— If present, version MUST be v2 or v3 subjectUniquelD [2] IMPLICIT Uniqueldentifier OPTIONAL, ~ If present, version MUST be v2 or v3 extensions [3] EXPLICIT Extensions OPTIONAL ~ If present, version MUST be v3

}

Version ::= INTEGER { vl(0), v2(l), v3(2) } CertificateSerialNumber ::= INTEGER

Validity ::= SEQUENCE { notBefore Time, notAfter Time }

Time ::= CHOICE { utcTime UTCTime, generalTime GeneralizedTime } Uniqueldentifier ::= BIT STRING

Subj ectPublicKeylnfo ::= SEQUENCE { algorithm Algorithmldentifier, subjectPublicKey BIT STRING }

Extensions ::= SEQUENCE SIZE (1.. MAX) OF Extension Extension ::= SEQUENCE { extnID OBJECT IDENTIFIER, critical BOOLEAN DEFAULT FALSE, extnValue OCTET STRING }

Claims

What is claimed is:CLAIMS

1. A method of authenticating a device in a network, the method comprising: providing a network, the network comprising: an authentication granting unit; a first device; and a second device; the authentication granting unit granting a first certificate to the first device at at least one of: when the first device joins the network; and at a later time, the first certificate comprising a physical address corresponding to a physical address of the first device, the first certificate representing proof that the first device is comprised in the network; the authentication granting unit granting a second certificate to the second device at at least one of: when the second device joins the network; and at a later time, the second certificate comprising a physical address corresponding to a physical address of the second device, the second certificate representing proof that the second device is comprised in the network; the first device requesting authentication from the second device, the authentication comprising at least a certification that the second device is comprised in the network; and the second device providing the certification to the first device, the certification comprising at least a portion of the second certificate.

2. The method according to claim 1 and wherein the first certificate and the second certificate each further comprises a network ID.

3. The method according to claim 2 and wherein the network ID is unique to the network.

4. The method according to any of claims 1 - 3 and wherein the first certificate and the second certificate each comprises an X.509 certificate.

5. The method according to any of claims 1 - 4 and wherein the network is a home network.

6. The method according to any of claims 1 - 5 and wherein the first device also comprises an authentication granting unit.

7. The method according to any of claims 1 - 6 and wherein content is transferred between the first device and the second device only after the second device has provided the first device with the certification that the second device is comprised in the network.

8. The method according to any of claims 1 - 7 and wherein the first device is additionally connected to a second network.

9. The method according to any of claims 1 - 8 and wherein the second device is additionally connected to a second network.

10. The method according to either claim 8 or claim 9 and wherein the second network comprises the Internet.

11. The method according to any of claims 1 - 10 and wherein at least on of the first certificate and the second certificate are cached at a network switch / hub.

12. The method according to any of claims 7 - 11 and wherein the content comprises a digital rights management (DRM) descriptor.

13. The method according to claim 12 and wherein the DRM descriptor comprises one of the following restrictions / limitations: no transfer at all, even within the home network; free transfer within the home network , and no transfer outside of the home network; and free transfer both inside and outside the home network.

14. The method according to either claim 12 or claim 13 and wherein the content is only transferred between the first device and the second device if in accordance with the DRM descriptor.

15. A system for authenticating a device in a network, the system comprising: in a network comprising: an authentication granting unit; a first device; and a second device; the authentication granting device operative to grant a first certificate to the first device at at least one of: when the first device joins the network; and at a later time, the first certificate comprising a physical address corresponding to a physical address of the first device, the first certificate representing proof that the first device is comprised in the network; the authentication granting device operative to grant a second certificate to the second device at at least one of: when the second device joins the network; and ^■ at a later time, the second certificate comprising a physical address corresponding to a physical address of the second device, the second certificate representing proof that the second device is comprised in the network; the first device operative to request authentication from the second device, the authentication comprising at least a certification that the second device is comprised in the network; and the second device operative to provide the certification to the first device, the certification comprising at least a portion of the second certificate.